Fix for Clarity directory traversal vulnerability

lib/clarity.rb

@@ -18,6 +18,6 @@
 module Clarity
   VERSION = '0.9.8'  
 
-  Templates = File.dirname(__FILE__) + '/../views'
-  Public    = File.dirname(__FILE__) + '/../public'
+  Templates = File.expand_path(File.dirname(__FILE__) + '/../views')
+  Public    = File.expand_path(File.dirname(__FILE__) + '/../public')
 end

lib/clarity/server/chunk_http.rb

@@ -1,11 +1,11 @@
 require 'erb'
 
 module Clarity
-  
+
   module ChunkHttp
-    
-    LeadIn    = ' ' * 1024    
-    
+
+    LeadIn    = ' ' * 1024
+
     def respond_with_chunks
       response = EventMachine::DelegatedHttpResponse.new( self )
       response.status = 200
@@ -23,7 +23,7 @@ def respond_with(status, content, options = {})
       response.status  = status
       response.content = content
       response.send_response
-    end    
+    end
 
     def render(view)
       @toolbar = template("_toolbar.html.erb")
@@ -32,28 +32,35 @@ def render(view)
     end
 
     def template(filename)
-      content = File.read( File.join(Clarity::Templates, filename) ) 
+      content = File.read( File.join(Clarity::Templates, filename) )
       ERB.new(content).result(binding)
     end
 
     def public_file(filename)
-      File.read( File.join(Clarity::Public, filename) ) 
-    rescue Errno::ENOENT
-      raise NotFoundError
+      path = File.expand_path(File.join(Clarity::Public, filename))
+      raise NotFoundError unless path[0, Clarity::Public.length] == Clarity::Public
+      raise NotFoundError unless File.file?(path)
+      File.read(path)
     end
 
     def logfiles
       log_files.map {|f| Dir[f] }.flatten.compact.uniq.select{|f| File.file?(f) }.sort
     end
-        
+
     def params
       ENV['QUERY_STRING'].split('&').inject({}) {|p,s| k,v = s.split('=');p[k.to_s] = CGI.unescape(v.to_s);p}
-    end  
+    end
 
     def path
       ENV["PATH_INFO"]
     end
-
+
+    def json_encode(obj)
+      obj.to_json.
+        gsub('>', '\u003E').
+        gsub('<', '\u003C')
+    end
+
   end
-  
+
 end

views/_toolbar.html.erb

@@ -53,12 +53,12 @@
         <li><input type='checkbox' name='enable_scrolling' id='auto-scroll'/><span> Auto scroll?</span></li>
       </ul>
     </div>
-    
+
     <script>
         Search.url = "<%= relative_root %>" + Search.url;
         Search.init({ 'grep': <%= logfiles.map {|f| f }.to_json %>, 
                       'tail': <%= logfiles.map {|f| f }.to_json %> },
-                      <%= params.empty? ? 'null' : params.to_json %> );
+                      <%= params.empty? ? 'null' : json_encode(params) %> );
 
 
     </script>